Exposed RDP: The Misconfiguration Attackers Keep Exploiting

What it is

Huntress SOC field notes on internet-exposed RDP as a 2026 initial-access vector, drawn from three contained incidents. The value beyond the summary is the verbatim attacker command sequence for enabling RDP after lateral movement, plus named tooling and infrastructure worth turning into detections.

How it works

Three distinct entry shapes, all opportunistic rather than targeted:

• Direct port exposure — automated internet-wide scanning finds an open port 3389 and begins the intrusion with no exploit or custom tradecraft.
• RDWeb portal — attackers reached an internal environment through an exposed Remote Desktop Web Access portal, deploying a custom reverse tunnel (Windows and Linux builds) and background credential-harvesting scripts for persistence.
• RDP as a lateral-movement payload — after entering via a vulnerable SonicWall VPN, the attacker enabled RDP themselves via registry and firewall changes to dig deeper.

The recurrence point matters: after the SOC evicted the RDWeb attacker, they returned the next morning through the same portal with a different compromised account, because the exposure hadn't been closed yet. Eviction without closing the entry point buys hours, not safety.

Preconditions / Affected

RDP or RDWeb reachable from the internet, or a perimeter VPN (SonicWall in this case) that an attacker can pivot through. The third case required attacker-side local admin to edit HKLM and firewall rules.

What to do

Put RDP behind a firewall / VPN — the report calls the healthcare case "entirely preventable" by that one change. For detection, alert on this post-compromise RDP-enablement sequence run against your own hosts:

reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
net stop TermService && timeout /t 2 && net start TermService
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
netsh advfirewall firewall add rule name="RDP-Open" dir=in protocol=TCP localport=3389 action=allow enable=yes
netsh advfirewall firewall set rule group="Remote Desktop" new enable=yes

Other observables from the SonicWall case: launchpad infrastructure on cheap hosts (Hostinger, Freakhosting), authentication from a known-malicious workstation, and Advanced IP Scanner used for enumeration. When you get an RDP-exposure alert, treat closing it — not just evicting the attacker — as the remediation; the RDWeb case shows they come back to an open door within a day.

Caveats

All three were contained incidents at organizations with mature defenses (SIEM caught initial access; managed EDR caught the lateral movement) — these are near-misses, not breaches, so they show what detection catches, not the full impact of an unmonitored exposure. The page's text is truncated before its concluding recommendations.